JFrog Infrastructure as Code

Name: JFrog Infrastructure as Code
Brand: JFrog
Rating: 4.2 (149 reviews)

Leader

On a mission to create a world of software delivered without friction from developer to device.

Est 2008|Valuation $11.7B|Raised $580M

LinkedIn 104K|Website|Web traffic 532K|FTEs 1,800|HQ Sunnyvale, California, US

MarketsApplication Security Testing (AST)Artifact Management IaC Security

Published May 16, 2026

01Common complaints

Consider alternatives when: 1. IaC security is the primary requirement and broad IaC language support plus developer-centric remediation workflows are required. (Consider Snyk IaC, Prisma Cloud, or Bridgecrew.) 2. There is no intent to standardize on an artifact platform. If Artifactory is not part of the architecture, Xray/Advanced Security’s value may be reduced. 3. Budget constraints and small-team footprints make a platform approach less cost-effective compared with simpler registries or repository tools. 4. Preventive, before-consumption gating is a strict requirement; evaluate Sonatype Firewall-style workflows and compare to JFrog’s policy enforcement design. 5. Immediate time-to-value is required and long setup cycles are not acceptable; reviewers cite significant initial integration effort in some deployments.

Deal disqualifiers (poor fit)

IaC security is the primary requirement and broad IaC language support is needed.
Small teams with strict cost sensitivity and basic artifact needs.

Publicly observable limitations and risks

- IaC format support ambiguity: marketing pages discuss IaC generally, but the webinar Q&A indicates IaC scanning currently supports Terraform. Treat other IaC formats as not guaranteed until confirmed in documentation and validated in a proof-of-concept. - Reporting and UI: some reviewer platforms and independent feedback cite reporting and UI gaps, API limitations, and performance concerns in certain environments. - Support variability: community threads cite negative incident experiences; buyers should validate support SLA terms for the chosen tier. - Pricing predictability: the Contributing Developer metric can be non-obvious; perform pricing scenario analysis prior to purchase.

Roadmap uncertainty

Public roadmaps for IaC scanning breadth are not clearly enumerated in the reviewed sources. Buyers should request:
- supported IaC types and file formats
- roadmap and timelines for additional IaC coverage
- supported policy frameworks (for example, OPA/Rego or custom rule support)

02Why they buy

Validated by customer and reviewer feedback (where available)

Integration breadth: reviewers frequently cite support for many package formats and integrations with CI/CD and DevOps tooling.
Xray and Artifactory integration: reviewers emphasize value from scanning artifacts in a central repository.

Vendor-claimed differentiation (verify in pilots)

JFrog marketing highlights research-backed capabilities (malicious package databases, published findings, etc.). Buyers should validate false-positive and false-negative rates in their environment, performance at scale, and exact IaC type coverage and policy support during pilots.

Why customers chose JFrog (themes across sources)

Desire for a single platform to manage many artifact formats alongside integrated security scanning.
Hybrid or multi-cloud support and enterprise scalability.
Integration depth with CI/CD tooling.

03Field reports

JFrog publishes case studies and success narratives; many are vendor-produced and can lack methodology transparency.

Gartner Peer Insights (review platform)

Gartner Peer Insights content is partially visible without login; the vendor page indicates JFrog has reviews across markets. Examples visible on the JFrog Software Supply Chain Platform review page include: Positive (paraphrased): - A reviewer highlights detailed license compliance checks, scalability and high availability, and deep integration with Artifactory, plus broad package-format support. Mixed (paraphrased): - Another review notes initial setup is complex and requires significant time, but reviewers report the platform requires less active maintenance after initial deployment. Note: Full review text may require access; available snippets should be treated as partial context.

G2 (review platform)

G2 reviews for the JFrog Software Supply Chain Platform and related products consistently report appreciation for breadth and integration, alongside criticism about complexity and cost. Positive (paraphrased): - Reviewers note automation through integration with Kubernetes, Helm, Terraform, and other DevOps tools. Negative/constructive (paraphrased): - Reports of long initial integration time, comparatively high cost for some customers, occasional delays in customer support, management complexity, and UI usability concerns.

TrustRadius (review platform)

TrustRadius reviews for JFrog Artifactory include feedback on the maturity of the Xray add-on in some deployments.

Negative (paraphrased):

At least one reviewer reported that Xray did not meet their maturity expectations for their environment.

Note: TrustRadius reviews vary by product and time; single reviews represent discrete data points, not universal conclusions.

Community / social (Reddit)

Reddit discussions show both advocacy and frustration—especially around support responsiveness, outages, and licensing. Support/outage experiences (paraphrased): - In threads about alternatives, some posts claim that during outages JFrog support did not meet live support requests. Pricing/upsell concerns (paraphrased): - Some users report being offered Xray-enabled versions at substantially higher prices and describe the process as upsell-driven. Operational feedback (paraphrased): - One older thread reported significant challenges migrating to a newer JFrog platform configuration and issues with support for HA cluster scenarios. Positive user reports (paraphrased): - Some users report that Xray’s auto-blocking capability was useful for preventing undesirable downloads.

HackerNews

A search for JFrog + Infrastructure as Code on HackerNews did not surface high-signal, directly relevant threads in the accessible results during this research pass.

Why some customers leave or consider alternatives (themes)

Perceived high cost and upsell practices.
Complexity of setup and ongoing management.
Variable support responsiveness during incidents.

Example vendor-claimed outcomes

A JFrog blog post about an AWS Security Competency lists customer anecdotes and one claim that Technology Innovation Institute achieved a substantial reduction in build and deploy times.

Critical evaluation:

The claimed reduction appears in a vendor-authored context; the methodology, baseline, and measurement period are not disclosed in the excerpted source. Treat such metrics as directional unless independently validated.

Internal workflow example (JFrog’s own IaC practices)

JFrog describes using Crossplane to deliver self-service cloud environments in its engineering organization.

Critical evaluation:

This describes JFrog’s internal operational approach, but it is not independent validation of IaC scanning efficacy.

04Best fit

Company size

Most suitable for mid-market to large enterprise environments with multiple teams and significant artifact volume.
Practical ICP range (inferred from review demographics and typical platform adoption): mid-market to enterprise organizations with multi-team engineering structures.

Industries

Frequent presence in financial services, banking, software, and IT services.

Roles/personas

Decision makers: VP Engineering, Head of DevOps/Platform Engineering, CISO / AppSec leadership
Users: DevOps engineers, build and release engineers, security engineers, platform engineers

Pain points addressed

Centralize and govern artifacts, reduce supply chain risk, enforce security policies, generate SBOMs, and integrate security scanning into pipelines.

Deal qualifiers (good fit)

Organizations already relying on JFrog Artifactory or seeking a universal repository.
Need for a unified control plane for artifacts and scanning.
Terraform is the primary IaC language in use (given the stated Terraform support for IaC analysis).

05The pitch

What the product does (core value proposition)

“JFrog Infrastructure as Code” is not a standalone SKU in the way tools like Snyk IaC or Bridgecrew are; it is primarily presented as IaC security scanning and governance capabilities embedded into the JFrog Platform, primarily delivered via JFrog Xray and JFrog Advanced Security. The value proposition is to: - Store and govern IaC artifacts (notably Terraform modules/providers/state) in JFrog Artifactory, alongside application artifacts. - Scan IaC for misconfigurations and exposures (for example, overly permissive cloud resources) as part of a broader software supply chain security workflow. - Integrate into CI/CD, policy enforcement, and DevSecOps workflows so IaC issues are detected earlier in the development lifecycle. JFrog’s public material frames IaC as an expanding attack surface and positions Xray/Advanced Security as a mechanism to scan IaC files stored in Artifactory to reduce misconfiguration-driven risk. A JFrog-hosted webinar Q&A states that IaC scanning currently supports Terraform.

Target market and positioning

Primary target: mid-market to enterprise organizations running multi-team DevOps and DevSecOps with centralized artifact management and a need for supply-chain security controls.
Positioning: a platform approach (system of record for binaries plus security controls) rather than a specialized IaC security product.
Common environments: regulated industries (financial services, banking, defense) appear frequently in review demographics and testimonials.

Get a comprehensive analysis of JFrog Infrastructure as Code including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published May 16, 2026

01Common complaints

Consider alternatives when:

IaC security is the primary requirement and broad IaC language support plus developer-centric remediation workflows are required. (Consider Snyk IaC, Prisma Cloud, or Bridgecrew.)
There is no intent to standardize on an artifact platform. If Artifactory is not part of the architecture, Xray/Advanced Security’s value may be reduced.
Budget constraints and small-team footprints make a platform approach less cost-effective compared with simpler registries or repository tools.
Preventive, before-consumption gating is a strict requirement; evaluate Sonatype Firewall-style workflows and compare to JFrog’s policy enforcement design.
Immediate time-to-value is required and long setup cycles are not acceptable; reviewers cite significant initial integration effort in some deployments.

Deal disqualifiers (poor fit)

IaC security is the primary requirement and broad IaC language support is needed.
Small teams with strict cost sensitivity and basic artifact needs.

Publicly observable limitations and risks

IaC format support ambiguity: marketing pages discuss IaC generally, but the webinar Q&A indicates IaC scanning currently supports Terraform. Treat other IaC formats as not guaranteed until confirmed in documentation and validated in a proof-of-concept.
Reporting and UI: some reviewer platforms and independent feedback cite reporting and UI gaps, API limitations, and performance concerns in certain environments.
Support variability: community threads cite negative incident experiences; buyers should validate support SLA terms for the chosen tier.
Pricing predictability: the Contributing Developer metric can be non-obvious; perform pricing scenario analysis prior to purchase.

Roadmap uncertainty

Public roadmaps for IaC scanning breadth are not clearly enumerated in the reviewed sources. Buyers should request:
- supported IaC types and file formats
- roadmap and timelines for additional IaC coverage
- supported policy frameworks (for example, OPA/Rego or custom rule support)

02Why they buy

Validated by customer and reviewer feedback (where available)

Integration breadth: reviewers frequently cite support for many package formats and integrations with CI/CD and DevOps tooling.
Xray and Artifactory integration: reviewers emphasize value from scanning artifacts in a central repository.

Vendor-claimed differentiation (verify in pilots)

JFrog marketing highlights research-backed capabilities (malicious package databases, published findings, etc.). Buyers should validate false-positive and false-negative rates in their environment, performance at scale, and exact IaC type coverage and policy support during pilots.

Why customers chose JFrog (themes across sources)

Desire for a single platform to manage many artifact formats alongside integrated security scanning.
Hybrid or multi-cloud support and enterprise scalability.
Integration depth with CI/CD tooling.

03Field reports

JFrog publishes case studies and success narratives; many are vendor-produced and can lack methodology transparency.

Gartner Peer Insights (review platform)

Positive (paraphrased):

A reviewer highlights detailed license compliance checks, scalability and high availability, and deep integration with Artifactory, plus broad package-format support.

Mixed (paraphrased):

Another review notes initial setup is complex and requires significant time, but reviewers report the platform requires less active maintenance after initial deployment.

Note: Full review text may require access; available snippets should be treated as partial context.

G2 (review platform)

G2 reviews for the JFrog Software Supply Chain Platform and related products consistently report appreciation for breadth and integration, alongside criticism about complexity and cost.

Positive (paraphrased):

Reviewers note automation through integration with Kubernetes, Helm, Terraform, and other DevOps tools.

Negative/constructive (paraphrased):

Reports of long initial integration time, comparatively high cost for some customers, occasional delays in customer support, management complexity, and UI usability concerns.

TrustRadius (review platform)

TrustRadius reviews for JFrog Artifactory include feedback on the maturity of the Xray add-on in some deployments.

Negative (paraphrased):

At least one reviewer reported that Xray did not meet their maturity expectations for their environment.

Note: TrustRadius reviews vary by product and time; single reviews represent discrete data points, not universal conclusions.

Community / social (Reddit)

Reddit discussions show both advocacy and frustration—especially around support responsiveness, outages, and licensing.

Support/outage experiences (paraphrased):

In threads about alternatives, some posts claim that during outages JFrog support did not meet live support requests.

Pricing/upsell concerns (paraphrased):

Some users report being offered Xray-enabled versions at substantially higher prices and describe the process as upsell-driven.

Operational feedback (paraphrased):

One older thread reported significant challenges migrating to a newer JFrog platform configuration and issues with support for HA cluster scenarios.

Positive user reports (paraphrased):

Some users report that Xray’s auto-blocking capability was useful for preventing undesirable downloads.

HackerNews

A search for JFrog + Infrastructure as Code on HackerNews did not surface high-signal, directly relevant threads in the accessible results during this research pass.

Why some customers leave or consider alternatives (themes)

Perceived high cost and upsell practices.
Complexity of setup and ongoing management.
Variable support responsiveness during incidents.

Example vendor-claimed outcomes

A JFrog blog post about an AWS Security Competency lists customer anecdotes and one claim that Technology Innovation Institute achieved a substantial reduction in build and deploy times.

Critical evaluation:

The claimed reduction appears in a vendor-authored context; the methodology, baseline, and measurement period are not disclosed in the excerpted source. Treat such metrics as directional unless independently validated.

Internal workflow example (JFrog’s own IaC practices)

JFrog describes using Crossplane to deliver self-service cloud environments in its engineering organization.

Critical evaluation:

This describes JFrog’s internal operational approach, but it is not independent validation of IaC scanning efficacy.

04Best fit

Company size

Most suitable for mid-market to large enterprise environments with multiple teams and significant artifact volume.
Practical ICP range (inferred from review demographics and typical platform adoption): mid-market to enterprise organizations with multi-team engineering structures.

Industries

Frequent presence in financial services, banking, software, and IT services.

Roles/personas

Decision makers: VP Engineering, Head of DevOps/Platform Engineering, CISO / AppSec leadership
Users: DevOps engineers, build and release engineers, security engineers, platform engineers

Pain points addressed

Centralize and govern artifacts, reduce supply chain risk, enforce security policies, generate SBOMs, and integrate security scanning into pipelines.

Deal qualifiers (good fit)

Organizations already relying on JFrog Artifactory or seeking a universal repository.
Need for a unified control plane for artifacts and scanning.
Terraform is the primary IaC language in use (given the stated Terraform support for IaC analysis).

05The pitch

What the product does (core value proposition)

Store and govern IaC artifacts (notably Terraform modules/providers/state) in JFrog Artifactory, alongside application artifacts.
Scan IaC for misconfigurations and exposures (for example, overly permissive cloud resources) as part of a broader software supply chain security workflow.
Integrate into CI/CD, policy enforcement, and DevSecOps workflows so IaC issues are detected earlier in the development lifecycle.

JFrog’s public material frames IaC as an expanding attack surface and positions Xray/Advanced Security as a mechanism to scan IaC files stored in Artifactory to reduce misconfiguration-driven risk. A JFrog-hosted webinar Q&A states that IaC scanning currently supports Terraform.

Target market and positioning

Primary target: mid-market to enterprise organizations running multi-team DevOps and DevSecOps with centralized artifact management and a need for supply-chain security controls.
Positioning: a platform approach (system of record for binaries plus security controls) rather than a specialized IaC security product.
Common environments: regulated industries (financial services, banking, defense) appear frequently in review demographics and testimonials.

Get a comprehensive analysis of JFrog Infrastructure as Code including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →